Tomcat中的会话管理

问题描述:

我开发了一个带有2个servlet A和B的简单web应用程序。

I have developed a simple web-app with 2 servlets A and B.

我对Tomcat的web-app会话管理有些怀疑。

I have a few doubts related to session management for the web-app by Tomcat.

注意 - 访问网络应用时,我在网络浏览器(Chrome)中禁用了Cookie。

NOTE - I have disabled cookies in my web-browser (Chrome) while accessing the web-app.

1。)首次点击Web应用程序时,将调用Servlet A. Servlet A从请求中访问会话,并执行会话哈希码的简单sysout。然后它将 sendRedirect 发送到servlet B.

1.) When the web-app is first hit, Servlet A gets invoked. Servlet A accesses the session from the request and does a simple sysout of the session hashcode. It then does a sendRedirect to servlet B.

[根据我的理解,由于这是第一个请求,Tomcat将发送一个包含cookie的cookie新会话ID返回浏览器。但是,由于我们尚未使用 HttpResponse.encodeRedirectURL()编码重定向网址,因此重定向网址不会包含附加到其中的会话ID。如果我在这里错了,请纠正我。]

[According to my understanding, since this is the first request, Tomcat will send a cookie containing the new session ID back to the browser. However, since we have not "encoded" the redirect URL using HttpResponse.encodeRedirectURL(), the redirect URL will not contain the session ID appended to it. Please correct me if I am wrong here.]

2。)由于我的浏览器禁用了cookie,它将忽略cookie中发回的会话ID和问题对重定向URL的新请求(也没有附加会话ID)。

2.) Since cookies are disabled in my browser, it'll ignore the session ID sent back in the cookie and issue a new request to the redirect URL (which also does not have the session ID appended to it).

3。)新请求导致调用servlet B,whoch还访问请求会话并执行会话哈希码的sysout。

3.) The new request causes servlet B to be invoked, whoch also accesses the request session and does a sysout of the session hashcode.

令我困惑的是,Servlet A和B都输出相同的会话哈希码,这意味着它们得到了来自两个请求的相同会话。

What perplexes me is that both Servlets A and B output the same session hashcode, which means that they get the same session from both requests.

即使没有发送会话ID,来自浏览器的第二个请求如何映射到与之前相同的会话?

How does the second request from the browser map to the same session as before, even though no session ID has been sent ?

谢谢!

您确定已禁用内存中饼干?通常,浏览器会允许您禁用保存到磁盘的持久性cookie,但它们仍然允许内存cookie中的瞬态,这些cookie仅在浏览器会话期间保持驻留。

Are you certain you've disabled "in memory" cookies? Often browsers will let you disable persistent cookies which are saved to disk, but they'll still allow the transient in memory cookies which only stay resident during a browser session.

I建议 Wireshark 分析HTTP流。这样您就可以看到浏览器发送和接收的cookie。

I recommend Wireshark for analyzing the HTTP stream. That way you can see the cookies that are sent and received by your browser.